filter {
  if [fileset][module] == 'suricata' {
    mutate {
      rename => ["json", "suricata.eve"]
    }
  }
}
